JM - Society of Corporate Compliance and Ethics

■ The audit committee or the chairmanof the audit committee -complaints will not be filteredand the audit committee willreceive every communication■ Internal Audit■ Chief Compliance or EthicsOfficer■ In-House General Counsel■ External Legal Counsel■ If a third party service provider isused to initially receive the calls,one of the above parties or functionscan still screen and triagethe calls or complaints beforethey are routed to the audit committee.The function charged with receivingthe complaints will need to developprotocols, including a screening andtriage process. A qualified andtrained individual will evaluate thenature of the call or complaint, andthen ensure it is routed to theappropriate resource. If the matterinvolves improper accounting orfinancial control issues, then heightenedprocedures should be undertaken.Routing Complaints to the AuditCommitteeAs with any issue involving highlyplaced individuals in an organization,it would be futile to routewhistleblower complaints to management,if a member of managementwere allegedly implicated.Serious consideration should begiven to all complaints sent to, orhaving reviewed by, the person orfunction that typically receivesreports on ethical, legal, complianceviolations and other misconduct.Ideally, this individual or functionwill have sufficient independencefrom management to ensure thatthe complaint is appropriately routed.An additional protection is tohave all identified Sarbanes-Oxleycomplaints copied to a designatedmember of the audit committee. Ata minimum, the audit committeeshould be promptly notified of significantcommunications and periodicallyreceive summary informationon all Sarbanes-Oxley codedcomplaints.Classifying Sarbanes-OxleyWhistleblower ComplaintsOne of the challenges is to providesufficient guidelines to properlyclassify complaints that are thefocus of Sarbanes-Oxley. A balancemust be sought to reduce the likelihoodof deluging an audit committeewith irrelevant or immaterialmatters, or missing a complaint thatis not obviously or directly relatedto financial reporting, resulting inthe matter not being reported to theaudit committee and/or not fullyinvestigated. If an external vendor isutilized, a 2-stage process is probablyneeded. The external providercan be provided guidelines and definitionsfor classifying Sarbanes-Oxley matters, but it should not beexpected for them to have sufficientexpertise to assure accurate classification.Internal resources should beutilized for additional evaluation toensure complaints are not missed ormiscoded.Some factors to consider for codingSarbanes-Oxley complaints are:■ All financial reporting and internalauditing matters (e.g.,improper journal entries, improperbooking of expenses, off-balancesheet transactions, insidertrading, improper loans to executives,any financial data manipulation,etc.)■ All fraud allegations - with materialityconsiderations■ Certain misconduct allegations -materiality considerations■ Any misconduct involving highlevelofficers, executives or managers■ Complaints involving the ForeignCorrupt Practices Act, Anti-Kickback Act■ Depending on the industry, certainregulatory matters maybecome financial reporting or disclosuresissues. These caninclude marketing practices (e.g.,pressures to meet sales targets),government contracts and pricingconcerns, etc.Essentially, to incorporate the auditcommittee procedure, a companywill need to work with its vendor toset criteria for coding complaintsthat involve potential financialreporting issues. The organization'sown screening and triage processalso needs to be alert to Sarbanes-Oxley issues that come through thehotline. Procedures will be neededto manage the flow of informationto the audit committee. See the flowchart below for an example of howa financial reporting concern can beprocessed through a hotline system.Once an issue is deemed a financialContinued on page 12Society of Corporate Compliance and Ethics • (888) 277-4977 • www.corporatecompliance.orgFebruary 200511